Day two at Black Hat, and Check Point Research brought two talks to the stage that gave the room plenty to think about. One dug into a fifteen year old blind spot sitting inside Windows itself. The other pulled apart the agent frameworks powering today’s AI products and found familiar bugs wearing new clothes. Here’s what our researchers presented yesterday at Black HatBTR Reforged: The Driver Nobody Had Looked AtJiří Vinopal opened the day with a talk that started from an uncomfortable premise. Somewhere inside Windows Defender sits a kernel driver built to clean up malware that survives a normal removal. It runs in Ring 0, takes encrypted instructions from disk, and deletes itself when the job is done. Despite sitting on every Windows machine for over a decade, nobody had ever published an analysis of how it actually works. Jiří took it apart from raw binary, with no documentation and no symbols to lean on, across eighteen signed builds spanning Windows 7 through a fully updated Windows 11 25H2. Every single build carried the same hard coded encryption key. Once he learned to speak the driver’s language, he could hand it his own instructions instead of Defender’s. The talk walked through what that capability actually unlocks: a full set of Ring 0 file and registry operations, a boot phase window where the filesystem comes alive before Defender’s own protection does, and a live demo showing the entire Defender stack deleted from a fully patched, fully protected machine. Since the driver is doing exactly what Microsoft built it to do, there’s no CVE attached and no patch coming. Jiří released his tool, BTR_CLI, open source at the end of the session, along with detection guidance built on behavior rather than signatures. The line that summed it up best: the defensive technology became the offensive capability.No Tools Required: Post-Injection Exploitation Across AI Agent Frameworks Shahar Tal and Yarden Porat followed with a talk that pushed back on how the industry has been framing prompt injection. Treating it purely as a model behavior problem, or purely as tool misuse, misses where the real damage happens. It happens when content an attacker controls crosses into a framework’s own internal plumbing, its serialization, its caching, its file parsers, none of which were built to handle hostile input. Shahar and Yarden audited the frameworks much of the industry is actually building agents on: LangChain, Google’s ADK, Microsoft Agent Framework, and CrewAI. Across the four, they found 12 CVEs. The part that stuck with the room was how little the attacker has to do. In several cases, nobody calls the dangerous function directly. A poisoned document lands in the agent’s memory, and the framework’s own save and reload behavior fires the payload on its own. Their closing point landed hard: most of these bugs are ones the security community already knows how to fix. The challenge is recognizing them once they’ve moved into a new part of the stack. Breaking the Seal: Cracking Open Compiled V8 Bytecode MalwareAleksandra “Hasherezade” Doniec closed out Check Point Research’s part in the day’s event with a talk built around a simple, frustrating question. What do you do when you have to analyze an atypical malware format, for which tools are scarce? Aleksandra ran into this while tracking JSCeal, a cryptocurrency focused stealer Check Point Research has followed since early 2025. The payload arrives as compiled V8 JavaScript bytecode, wrapped in Brotli compression and run through a bundled Node.js runtime, with the original JavaScript obfuscated before it was ever compiled. Standard reversing tools barely touch this format. The original JavaScript from which the payload was generates is not distributed, and technically gone by the time an analyst gets a copy. Rather than settle for behavioral analysis alone, Aleksandra built a full deobfuscation pipeline to get back to something readable. It leans on View8, a disassembler built for this exact format, alongside a series of custom passes that unravel string encoding, undo control flow flattening, and strip away layers of proxy functions. The last stage hands the cleaned up output to an LLM, which proposes meaningful function names based on what the code actually does, turning a wall of gibberish identifiers into something an analyst can follow. Run across twenty real JSCeal payloads, the pipeline surfaced browser and cryptocurrency theft, Telegram session collection, keylogging, screenshot capture, and a local HTTPS interception proxy that installs an attacker controlled certificate, all recovered statically. Aleksandra released the toolkit as open source at the end of the talk, so other researchers can put it to use. Her closing thought fit the day well: compiled V8 bytecode doesn’t have to stay a sealed box. With the right pipeline, it turns back into something you can analyze like code. The post Day 2 at Black Hat: Check Point Research Takes the Stage appeared first on Check Point Research.